35a2b41ffbd723064445dd16ed0147075bb82a29fdac6ee5b3843a1510b50f02 | Triage

Analysis

max time kernel
63s
max time network
110s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:26

Sharing

Report Analysis Logs

General

Target

zeus 2_2.0.1.0.vir.exe
Size

125KB
MD5

2f7662f8dab77aaab2a1b61bb7baaca5
SHA1

66158e375564f6ed2ccdf35eec05fca55425b72e
SHA256

35a2b41ffbd723064445dd16ed0147075bb82a29fdac6ee5b3843a1510b50f02
SHA512

b5184567de27a282e59f52f0e0ff0e6b58ccefb3e9962b3b6a43a37da0b41aabe4aa9af2a163ecb312ab094cace85e2dc67c6df08a9079f09fb46eb9ce8f9a87

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 3828 WerFault.exe zeus 2_2.0.1.0.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2800 WerFault.exe
Token: SeBackupPrivilege 2800 WerFault.exe
Token: SeDebugPrivilege 2800 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.1.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.1.0.vir.exe"
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 380
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/2800-2-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download